UDP traffic

Datagrams matching asn:398722 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

16 datagrams from 10 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 6 NTP 4 SNMP 2 NetBIOS 1 Sun RPC 1 SSDP 1 SOAP 1

Latest DNS datagram, to 53/udp

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

Other services

14 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 7 STUN 4 XDMCP 1 DCE/RPC 1 SIP 1

Latest DTLS datagram, to 5684/udp

·~·r·r·_·BnS·r·3~_·Y·I·-N·> ·?·W·+·/· ·<· · · 127.0.0.1

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|

Unrecognised

43 datagrams from 16 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 43

Latest Unrecognised datagram, to 2363/udp

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

Peer-to-peer

2 datagrams from 2 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 2

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	17185/udp +3	6	5	28 to 54
NTP	123/udp	4	4	556.9
SNMPv2	161/udp	2	2	6.3
Portmap	111/udp	1	1	7 to 28
NetBIOS	137/udp	1	1	3.8
QOTD	17/udp	1	1	140.3
SSDP	1900/udp	1	1	30.8
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

ip.parrotdns.com A1

DNS record types

Networks

AS398722 Censys, Inc. from 16 sources75

Countries

US United States75

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
199.45.154.191	AS398722 Censys, Inc.	US	DNS	7	2026-10-07 13:22
199.45.154.190	AS398722 Censys, Inc.	US	SNMP	7	2026-10-07 12:32
199.45.154.185	AS398722 Censys, Inc.	US	Unrecognised	7	2026-10-07 10:27
199.45.154.184	AS398722 Censys, Inc.	US	Unrecognised	7	2026-10-07 15:57
199.45.154.183	AS398722 Censys, Inc.	US	DTLS	6	2026-10-07 16:42
199.45.154.181	AS398722 Censys, Inc.	US	Unrecognised	5	2026-10-07 17:51
199.45.154.186	AS398722 Censys, Inc.	US	Unrecognised	5	2026-10-07 15:12
199.45.154.188	AS398722 Censys, Inc.	US	Unrecognised	4	2026-10-07 09:05
199.45.154.179	AS398722 Censys, Inc.	US	Unrecognised	4	2026-10-06 22:57
199.45.154.189	AS398722 Censys, Inc.	US	Unrecognised	4	2026-10-06 04:11
199.45.154.177	AS398722 Censys, Inc.	US	Unrecognised	4	2026-10-07 04:18
199.45.154.180	AS398722 Censys, Inc.	US	Unrecognised	4	2026-10-07 10:37
199.45.154.178	AS398722 Censys, Inc.	US	Unrecognised	3	2026-10-07 04:20
199.45.154.182	AS398722 Censys, Inc.	US	Unrecognised	3	2026-10-07 17:03
199.45.154.176	AS398722 Censys, Inc.	US	Unrecognised	3	2026-10-07 08:11
199.45.154.187	AS398722 Censys, Inc.	US	STUN	2	2026-10-07 12:31

Latest datagrams

2026-10-07 17:51:45199.45.154.181to 5684/udpDTLSUS

·~·r·r·_·BnS·r·3~_·Y·I·-N·> ·?·W·+·/· ·<· · · 127.0.0.1

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|

2026-10-07 17:03:37199.45.154.182to 2363/udpUnrecognisedUS
DIGI·
payload bytes
```
00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|
```

2026-10-07 16:42:45199.45.154.183to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-07 15:57:45199.45.154.184to 427/udpUnrecognisedUS

·/·D·en·service:censys·DEFAULT·

payload bytes

00000000  02 01 00 00 2f 00 00 00  00 00 44 00 00 02 65 6e  |..../.....D...en|
00000010  00 00 00 0e 73 65 72 76  69 63 65 3a 63 65 6e 73  |....service:cens|
00000020  79 73 00 07 44 45 46 41  55 4c 54 00 00 00 00     |ys..DEFAULT....|

2026-10-07 15:12:12199.45.154.186to 47807/udpUnrecognisedUS

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-07 14:00:27199.45.154.184to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-07 13:22:58199.45.154.191to 2362/udpUnrecognisedUS
DIGI·
payload bytes
```
00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|
```
2026-10-07 12:32:04199.45.154.190to 2362/udpUnrecognisedUS
DIGI·
payload bytes
```
00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|
```

2026-10-07 12:31:13199.45.154.187to 19302/udpSTUNUS

·!·B"d?9·(·

payload bytes

00000000  00 01 00 00 21 12 a4 42  22 64 3f 39 ba 85 0f b5  |....!..B"d?9....|
00000010  f4 28 d7 fa                                       |.(..|

2026-10-07 11:05:01199.45.154.183to 5349/udpDTLSUS

·m·a·a·i·S·1 ·I/,w·n·F·mC·i· ·+·/· ·,·0·+· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 6d 01 00 00  |............m...|
00000010  61 00 00 00 00 00 00 00  61 fe fd 69 9f 53 c2 31  |a.......a..i.S.1|
00000020  0a ac c1 49 2f 2c 77 f9  aa 6e 8a d3 d5 46 04 6d  |...I/,w..n...F.m|
00000030  43 98 ea 69 81 09 f2 bb  9c 7f ce 00 00 00 0c c0  |C..i............|
00000040  2b c0 2f c0 0a c0 14 c0  2c c0 30 01 00 00 2b 00  |+./.....,.0...+.|
00000050  0d 00 0c 00 0a 04 01 04  03 04 01 05 01 06 01 ff  |................|
00000060  01 00 01 00 00 0a 00 08  00 06 00 1d 00 17 00 18  |................|
00000070  00 0b 00 02 01 00 00 17  00 00                    |..........|

2026-10-07 11:04:49199.45.154.181to 1967/udpUnrecognisedUS
·
payload bytes
```
00000000  01                                                |.|
```

2026-10-07 10:37:58199.45.154.180to 4786/udpUnrecognisedUS

payload bytes

00000000  00 00 00 01 00 00 00 01  00 00 00 04 00 00 00 08  |................|
00000010  00 00 00 01 00 00 00 00                           |........|

2026-10-07 10:27:43199.45.154.185to 5094/udpUnrecognisedUS
· ·u0
payload bytes
```
00000000  01 00 00 00 00 00 00 0d  01 00 00 75 30           |...........u0|
```

2026-10-07 09:05:18199.45.154.188to 500/udpUnrecognisedUS

xb·_?·O·! "·"· · ·

payload bytes

00000000  78 62 9a 0f 5f 3f 16 4f  00 00 00 00 00 00 00 00  |xb.._?.O........|
00000010  21 20 22 08 00 00 00 00  00 00 01 88 22 00 00 ec  |! "........."...|
00000020  00 00 00 e8 01 01 00 1c  03 00 00 08 01 00 00 01  |................|
00000030  03 00 00 08 01 00 00 02  03 00 00 08 01 00 00 03  |................|
00000040  03 00 00 08 01 00 00 04  03 00 00 08 01 00 00 06  |................|
00000050  03 00 00 08 01 00 00 07  03 00 00 08 01 00 00 08  |................|
00000060  03 00 00 08 01 00 00 09  03 00 00 08 01 00 00 0b  |................|
00000070  03 00 00 08 01 00 00 0c  03 00 00 08 01 00 00 0d  |................|
00000080  03 00 00 08 02 00 00 01  03 00 00 08 02 00 00 02  |................|
00000090  03 00 00 08 03 00 00 00  03 00 00 08 03 00 00 01  |................|
000000a0  03 00 00 08 03 00 00 02  03 00 00 08 03 00 00 03  |................|
000000b0  03 00 00 08 03 00 00 04  03 00 00 08 03 00 00 05  |................|
000000c0  03 00 00 08 04 00 00 00  03 00 00 08 04 00 00 01  |................|
000000d0  03 00 00 08 04 00 00 02  03 00 00 08 04 00 00 05  |................|
000000e0  03 00 00 08 04 00 00 0e  03 00 00 08 04 00 00 0f  |................|
000000f0  03 00 00 08 04 00 00 10  03 00 00 08 04 00 00 11  |................|
... 392 bytes shown in part

2026-10-07 08:41:06199.45.154.180to 5684/udpDTLSUS

·~·r·r·_·BnS·r·3~_·Y·I·-N·> ·?·W·+·/· ·<· · · 127.0.0.1

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|